Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

zope2

11 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
4.0.0 (May 10, 2019): no advisory affects it
Newest unaffected release
4.0.0 (May 10, 2019), the latest release
Advisories
11
Weekly downloads
5,310
Dependents
99
Releases
83 since 2.12.0 (Sep 30, 2009)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2011-4924
    Affects 2.12.0a1 to 2.12.21 (2.12.22 is outside it); 2.13.0a1 to 2.13.11 (2.13.12 is outside it)
  • CVE-2009-5145
    Affects 2.12.0a1 to 2.12.4 (2.12.5 is outside it)
  • CVE-2012-6661
    Affects 2.12.0a1 to 2.13.18 (2.13.19 is outside it)
  • CVE-2012-5507
    Affects 2.12.0a1 to 2.13.18 (2.13.19 is outside it)
  • CVE-2012-5489
    Affects 2.12.0a1 to 2.12.20 (2.12.21 is outside it); 2.13.0 to 2.13.10 (2.13.11 is outside it)
  • CVE-2012-5486
    Affects 2.12.0a1 to 2.13.18 (2.13.19 is outside it)
  • CVE-2011-3587
    Affects 2.12.0 to 2.12.19 (2.12.20 is outside it); 2.13.0 to 2.13.9 (2.13.10 is outside it)
  • CVE-2011-2528
    Affects 2.12.0 to 2.12.18 (2.12.19 is outside it); 2.13.0 to 2.13.7 (2.13.8 is outside it)
  • CVE-2010-1104
    Affects 2.12.0 to 2.12.2 (2.12.3 is outside it)
  • CVE-2006-4684
    No published release is affected
    No published release is affected
  • CVE-2006-3458
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6…

    Affected: fixed in 2.12.22; from 2.13.0a1, fixed in 2.13.12; fixed in 2.12.22; from 2.13.0a1, fixed in 2.13.12.

    Fixed in 2.12.22 (released Jan 18, 2012, 2868 days before disclosure) and 2.13.12 (released Jan 18, 2012, 2868 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6…

    Affected: fixed in 2.12.5.

    Fixed in 2.12.5 (released Apr 24, 2010, 2662 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which…

    Affected: fixed in 2.13.19.

    Fixed in 2.13.19 (released Oct 31, 2012, 733 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to…

    Affected: fixed in 2.13.19.

    Fixed in 2.13.19 (released Oct 31, 2012, 699 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3…

    Affected: fixed in 2.12.21; from 2.13.0, fixed in 2.13.11; fixed in 2.12.21; from 2.13, fixed in 2.13.11.

    Fixed in 2.12.21 (released Dec 12, 2011, 1023 days before disclosure) and 2.13.11 (released Dec 12, 2011, 1023 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject…

    Affected: fixed in 2.13.19.

    Fixed in 2.13.19 (released Oct 31, 2012, 699 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote…

    Affected: from 2.12.0, fixed in 2.12.20; from 2.13.0, fixed in 2.13.10; from 2.12.0, fixed in 2.12.20; from 2.13.0, fixed in 2.13.10.

    Fixed in 2.12.20 (released Oct 4, 2011, 6 days before disclosure) and 2.13.10 (released Oct 4, 2011, 6 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2)…

    Affected: from 2.12.0, fixed in 2.12.19; from 2.13.0, fixed in 2.13.8; from 2.12.0, fixed in 2.12.19; from 2.13.0, fixed in 2.13.8.

    Fixed in 2.12.19 (released Jun 28, 2011, 21 days before disclosure) and 2.13.8 (released Jun 28, 2011, 21 days before disclosure).

    The latest release, 4.0.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6…

    Affected: from 2.8.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.11; from 2.11.0, fixed in 2.11.6; from 2.12.0, fixed in 2.12.3; from 2.8.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.11; from 2.11.0, fixed in 2.11.6; from 2.12.0, fixed in 2.12.3.

    Fixed in 2.12.3 (released Jan 13, 2010, 71 days before disclosure, the advisory names 2.8.12, which was never published).

    The latest release, 4.0.0, is not affected.

  • The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText…

    Affected: from 2.7.0, through 2.7.9; from 2.8.0, fixed in 2.8.9.

    Fixed in 2.12.0 (released Sep 30, 2009, 1107 days after disclosure, the advisory names 2.8.9, which was never published).

    The latest release, 4.0.0, is not affected.

  • Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with…

    Affected: from 2.7.0, fixed in 2.7.8; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.3.

    Fixed in 2.12.0 (released Sep 30, 2009, 1181 days after disclosure, the advisory names 2.7.8, which was never published).

    The latest release, 4.0.0, is not affected.